Further Data Protection Commission advice for Google Analytics & the EU Cookie Directive

Using Google Analytics on websites in Ireland without getting express separate permission from users is not illegal, according to information from the Data Protection Commissioner’s Office.

However, the Office does warn website owners that they must inform visitors about the use of cookies on their sites’ homepages.  The clarification comes after the transposition of the EU’s E-Privacy Directive (2009/136/EC), commonly called the Cookie Directive, into law earlier this year.

The directive requires EU states to tighten regulations concerning the placing of cookies, small text files which can contain information about users’ site preferences and other data, on users’ computers.

While the directive has been described as “laughable”  it has caused much hand-wringing on the part of site owners and developers.  As a directive each member state of the EU can interpret the document differently, leading to some confusion on cross border sites.

Speaking to this site the Data Protection Commissioner’s office said;

“Further to the provisions of SI 336 of 2011 which implements the ePrivacy Directive in Ireland, this Office expects websites to make information available on their homepage in relation to cookie usage generally including third party analytics services such as Google Analytics but we do not consider that SI 336 of 2011 imposes a need for an explicit separate consent for Google Analytics use.”

Some in Ireland feared that the Irish view of the directive would be similar to that of the UK, whose view of the law requires sites to obtain express user consent when applying cookies, including those from Google Analytics.  The UK’s Information Commissioner’s Office’s own implementation of the directive asks users to accept cookies on the site before loading Google Analytics.  By its own admission the Commission said that “gaining consent will, in many cases, be a challenge.”

A study of the ICO’s website, using information gained through Freedom of Information requests, found that only 10% of the site’s users granted permission for the site to use cookies.  See the ICO’s data here.

The Irish Data Protection Commission’s advice would appear to be more relaxed than that of the UK which requires user permission be given “if you decide to use a cookie to collect statistical information about the use of your website.” (PDF | 182kB).